Commit eb75ce08 authored by Uli Schlachter's avatar Uli Schlachter
Browse files

Fix a leak in cairo-xcb's render compositor

The code here temporary replaces extents->clip with another clip to call
a function. Afterwards, it restores the previous copy. The temporary
clip is only freed when it still is pointed to by extents->clip.

This logic is wrong. It is indeed possible that the clip is simplified
and changes. In this case, the original clip is also correctly freed.
However, this still means that we have to clean up and destroy the new
clip. The previous code just leaked it.

This was originally identified by Massimo in [1]. I am just committing
his patch.


Fixes: cairo/cairo#24

Signed-off-by: Uli Schlachter's avatarUli Schlachter <>
parent f7054c89
......@@ -3144,8 +3144,7 @@ _clip_and_composite_boxes (cairo_xcb_surface_t *dst,
if (extents->clip != clip)
clip = NULL;
clip = extents->clip;
extents->clip = saved_clip;
_cairo_polygon_fini (&polygon);
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment